Matthew Meszaros b35e111705 fix: address the review on the CLI PR: give the sign-in handshake its own per-IP budget so a 200-poll login cannot lock the address out of the browser login, keep https for a remote host that names a port instead of sending a bearer token in cleartext, report truncation when a paginated walk stops at max-pages, accept a piped secret with no trailing newline, normalise WEBSOCKET_URL on its suffix so a bare /socket becomes a real endpoint, destroy a minted secret the moment its code expires, gate cli-installer-ci on the required status check, print a rejected flag instead of an unbound-variable error, and use a portable sha256 so the packaging runs on macOS

2026-09-04 21:03:58 -07:00

..

actions/setup-pnpm

feat: give warmblyctl an API-key half so agents and scripts can operate any Warmbly instance, ship in-repo agent skills that teach it, and cut the README quick start and self-hosting sections down to commands plus docs links (#135)

2026-08-19 20:59:40 -07:00

scripts

feat: fix the release notes so What's Changed renders as grouped sections instead of one crammed paragraph: the changelog step encoded newlines as %0A for the set-output command GitHub disabled in 2022, so all 50 commits collapsed into a single run-on line with literal %0A separators, and generate_release_notes:true alongside a hand-written body made GitHub append a second duplicate What's Changed section (44KB body on v0.2.1); a new .github/scripts/release-notes.sh now walks --first-parent so each PR is one entry, takes the PR title from the merge commit body, groups by conventional-commit type into Features/Fixes/Performance/Security/Documentation/Maintenance/Other, trims this repo's deliberately long subjects at a clause boundary, links the PR (or the commit for direct pushes), picks the previous tag via git tag --sort=-v:refname --merged so stable releases skip prereleases and still list what an rc covered, states truncation instead of silently cutting at 50, and the workflow passes the assembled body via body_path so no escaping layer remains

2026-08-24 20:23:41 -07:00

workflows

fix: address the review on the CLI PR: give the sign-in handshake its own per-IP budget so a 200-poll login cannot lock the address out of the browser login, keep https for a remote host that names a port instead of sending a bearer token in cleartext, report truncation when a paginated walk stops at max-pages, accept a piped secret with no trailing newline, normalise WEBSOCKET_URL on its suffix so a bare /socket becomes a real endpoint, destroy a minted secret the moment its code expires, gate cli-installer-ci on the required status check, print a rejected flag instead of an unbound-variable error, and use a portable sha256 so the packaging runs on macOS

2026-09-04 21:03:58 -07:00